Analysis
- max time kernel
31s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
01/01/2024, 09:01
General
- Target 3c7117f96c0c2879798a78a32d5d34cc.exe
- Size 955KB
- Sample240101-kyxetshhh4
- SHA256 6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162
Malware Config
Extracted
-
ffdroider
-
http://186.2.171.3
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c7117f96c0c2879798a78a32d5d34cc.exe"C:\Users\Admin\AppData\Local\Temp\3c7117f96c0c2879798a78a32d5d34cc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5108-0-0x0000000000400000-0x000000000067D000-memory.dmp
memory/5108-1-0x0000000000400000-0x000000000067D000-memory.dmp
memory/5108-6-0x0000000000400000-0x000000000067D000-memory.dmp
memory/5108-14-0x0000000003D60000-0x0000000003D70000-memory.dmp
memory/5108-22-0x0000000004820000-0x0000000004828000-memory.dmp
memory/5108-28-0x0000000004A20000-0x0000000004A28000-memory.dmp
memory/5108-27-0x00000000048A0000-0x00000000048A8000-memory.dmp
memory/5108-30-0x0000000004BD0000-0x0000000004BD8000-memory.dmp
memory/5108-52-0x0000000004A30000-0x0000000004A38000-memory.dmp
memory/5108-54-0x0000000004B60000-0x0000000004B68000-memory.dmp
memory/5108-77-0x0000000004A30000-0x0000000004A38000-memory.dmp
memory/5108-75-0x0000000004B60000-0x0000000004B68000-memory.dmp
memory/5108-117-0x0000000004700000-0x0000000004708000-memory.dmp
memory/5108-129-0x0000000004F20000-0x0000000004F28000-memory.dmp
memory/5108-128-0x00000000047A0000-0x00000000047A8000-memory.dmp
memory/5108-131-0x00000000050C0000-0x00000000050C8000-memory.dmp
memory/5108-153-0x0000000004F30000-0x0000000004F38000-memory.dmp
memory/5108-155-0x0000000005060000-0x0000000005068000-memory.dmp
memory/5108-168-0x0000000004700000-0x0000000004708000-memory.dmp
memory/5108-145-0x0000000004700000-0x0000000004708000-memory.dmp
memory/5108-132-0x0000000004F30000-0x0000000004F38000-memory.dmp
memory/5108-130-0x00000000051C0000-0x00000000051C8000-memory.dmp
memory/5108-125-0x00000000047A0000-0x00000000047A8000-memory.dmp
memory/5108-116-0x00000000046E0000-0x00000000046E8000-memory.dmp
memory/5108-67-0x0000000004820000-0x0000000004828000-memory.dmp
memory/5108-44-0x0000000004820000-0x0000000004828000-memory.dmp
memory/5108-31-0x0000000004A30000-0x0000000004A38000-memory.dmp
memory/5108-29-0x0000000004CD0000-0x0000000004CD8000-memory.dmp
memory/5108-506-0x0000000000400000-0x000000000067D000-memory.dmp
memory/5108-24-0x00000000048E0000-0x00000000048E8000-memory.dmp
memory/5108-21-0x0000000004800000-0x0000000004808000-memory.dmp
memory/5108-8-0x0000000003C00000-0x0000000003C10000-memory.dmp